CVE-2026-16566: 
Ansible vulnerability analysis and mitigation

CVE-2026-16566 is an information exposure vulnerability in the jenkins_credential module of the community.general Ansible collection. When creating a Jenkins API token (credential_type: token), the module exposes the generated API token in plaintext through Ansible task output and associated logging systems. The CVE was published on July 22, 2026, and is currently in Reserved status with a CVSS severity estimate of Medium. All versions of the collection containing the jenkins_credential module are affected, with a fix pending upstream (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an instance of CWE-532 (Insertion of Sensitive Information into Log File) or CWE-312 (Cleartext Storage of Sensitive Information). In plugins/modules/jenkins_credential.py, when credential_type is set to token, the module calls the Jenkins API to generate a new API token and stores the returned value at line 793 (result["token"] = response_data["data"]["tokenValue"]), then passes the full result dictionary to module.exit_json(**result) at line 794. While the input password is correctly protected via no_log=True in the argument specification (line 527), no equivalent suppression is applied to the generated token in the return value, causing it to be emitted in plaintext (Red Hat Bugzilla).

An attacker with access to any of the affected output channels — including Ansible terminal/log output, AWX/Tower/AAP Controller job logs stored in the database, Ansible callback plugins (e.g., log_plays, syslog_json, splunk), CI/CD pipeline build logs, or fact caching backends — can retrieve the Jenkins API token in plaintext. The exposed token grants the attacker the same Jenkins privileges as the user who created it, potentially enabling unauthorized access to Jenkins jobs, build artifacts, credentials stored in Jenkins, and connected infrastructure (Red Hat Bugzilla).

1. Identify target environment: Determine that the target organization uses the community.general Ansible collection's jenkins_credential module with credential_type: token in their automation workflows.
2. Gain access to output channels: Obtain access to one or more of the following: Ansible terminal/log output, AWX/Tower/AAP Controller job logs, CI/CD pipeline build logs (e.g., Jenkins, GitLab CI, GitHub Actions), Ansible callback plugin outputs (syslog, Splunk), or fact caching backends.
3. Locate token in logs: Search log output for the token key in Ansible task results, which will contain the Jenkins API token in plaintext (e.g., grep for "token": or tokenValue in job logs or stored results).
4. Authenticate to Jenkins: Use the extracted API token to authenticate to the Jenkins instance as the credential-owning user, gaining access to jobs, build artifacts, stored credentials, and connected systems (Red Hat Bugzilla).

• Logs: Ansible task output or AWX/Tower/AAP Controller job logs containing a token field with a Jenkins API token value in plaintext alongside jenkins_credential module task results.
• Logs: CI/CD pipeline build logs (Jenkins, GitLab CI, GitHub Actions, etc.) showing tokenValue or "token": keys in Ansible output sections.
• Logs: Syslog, Splunk, or other callback plugin outputs containing Jenkins API token strings emitted from Ansible runs using the jenkins_credential module.
• Network: Unexpected Jenkins API authentication events using API tokens, particularly from IP addresses or systems not normally associated with Jenkins administration (Red Hat Bugzilla).

The recommended fix, as suggested by the reporter and documented in the Red Hat Bugzilla entry, is to remove tokenValue from the result dictionary and return only tokenUuid, preventing the sensitive token from appearing in output. A fixed version is pending upstream in the ansible-collections/community.general repository. As an immediate workaround, operators should audit existing logs and job outputs for exposed tokens, revoke any potentially exposed Jenkins API tokens, and restrict access to AWX/Tower/AAP Controller job logs, CI/CD pipeline logs, and Ansible callback plugin outputs to authorized personnel only (Red Hat Bugzilla, Red Hat Advisory).